anon-read access implemented and no shadow fs

(with Gunnar) Added various checks to limit access to primary and
secondary datasets (p-files and dicoms files) to users with > anon-read.
We also removed the dependence on the shadow FS for single-file
downloads. These now all filter through our TG controller. Remaining
items:
- make the file list dialog prettier (generated as raw html in auth.py)
- add the file size (so browser can show a progress bar)
- secure the shadow FS (currently still used for image pyramid) so that
  anon-read users can't get to primary/secondary files through that.